Do Small Businesses Need an IT Provider?
An IT provider can take care of devices, backups and security settings, but not everything. What to outsource, what to keep in-house, and questions to ask before signing.
Many small businesses rely on a friend, a family member or a part-time helper for IT. That can work, until something breaks at a bad moment. An IT provider can bring consistency, but outsourcing does not mean handing over responsibility.
What a provider can do well
- Setting up and updating devices. See device updates.
- Managing backups and testing restores. See backups.
- Configuring email and cloud security settings. See securing office suites.
- Helping during incidents. See working with your IT provider in an incident.
What to keep in-house
- Ownership of admin accounts, domain names and billing. See domain security.
- Payment approvals and verification rules.
- Decisions about what data you keep and why.
- A way to access your own systems if the provider disappears. See break-glass access.
Questions to ask
- How do you secure your own access to our systems?
- Who in your team can access our data?
- How quickly do you respond to incidents, including out of hours?
- Can we see what you have configured, and export it if we leave?
Providers are a target too. Attackers compromise IT providers to reach many customers at once. See supply chain attacks.
Related: choosing a managed security provider. For more, see our complete guide to small business cybersecurity.
Frequently asked questions
At what size does a business need an IT provider?
There is no fixed size. It depends on how many devices and systems you have, how critical they are, and whether anyone internally has time and skills.
What should never be fully outsourced?
Ownership of accounts and decisions about payments, data and risk. You should always be able to access your own systems.
How do I check an IT provider is secure?
Ask how they protect their own access to your systems, whether they use two-step verification, and what happens if they are breached.
Sources
- Small organisations guide to cyber security, UK National Cyber Security Centre
- Supply chain security guidance, UK National Cyber Security Centre
- Cybersecurity for Small Business, US Federal Trade Commission
